EUVD-2026-70798
GHSA-77pq-762c-pm6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Entra ID auth endpoint
-
DeliveryCraft request via alternate channel
-
ExploitBypass authentication check (CWE-288)
-
ExecutionObtain elevated token/context
-
ImpactAccess tenant resources as privileged identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Per CVSS AV:N/AC:L/PR:N/UI:N, no special conditions - remote unauthenticated exploitation over the network against Microsoft Entra ID, with no user interaction and low attack complexity. The specific 'alternate path or channel' (CWE-288) that must be reached is not detailed in the terse MSRC-sourced description, so the exact endpoint, protocol, or tenant configuration required cannot be confirmed from available data; the primary limiting factor is that Microsoft applies the fix service-side, which may already close the window for many or all tenants. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the maximal remote-unauthenticated profile: no privileges, no user interaction, low complexity, and total loss of confidentiality, integrity, and availability, which is consistent with the SSVC assessment of 'Automatable: yes, Technical Impact: total.' Counterbalancing this, the EPSS score is low at 0.58% (46th percentile) and SSVC exploitation status is 'none,' meaning no public exploit identified at time of analysis and no CISA KEV listing - the high score reflects potential severity, not observed activity. Because Entra ID is a shared cloud identity fabric, a genuine authentication bypass there is systemically dangerous regardless of any single tenant's size, and even a mid-sized municipal IT team should treat an identity-provider auth-bypass advisory from Microsoft as urgent and confirm the service-side fix status. Net: treat as high priority for verification and monitoring, but the current absence of exploit signals suggests it is not yet under active or widespread exploitation. |
| Exploit ScenarioDerived | A remote attacker with no credentials reaches an Entra ID authentication endpoint through a secondary, less-validated channel and submits a request that the primary auth flow would have rejected, obtaining a token or privileged context for a targeted tenant. With that elevated access the attacker could impersonate users or gain administrative control over federated resources. No public exploit identified at time of analysis, but SSVC flags the technique as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Privilege escalation in Microsoft Entra ID (formerly Azure Active Directory) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel and gain elevated privileges over the network. The flaw affects Microsoft's cloud identity-and-access-management service, which underpins sign-in and authorization for Microsoft 365, Azure, and countless federated third-party applications. No public exploit identified at time of analysis and SSVC records exploitation status as none, but the CISA SSVC framework rates the attack as automatable with total technical impact.
Earlier versions of this analysis (1)
Privilege elevation in Microsoft Entra ID (formerly Azure AD) lets a remote, unauthenticated attacker bypass authentication through an alternate path or channel (CWE-288) and gain elevated privileges over the network. Because Entra ID is the identity backbone for Microsoft 365 and Azure, a successful bypass exposes confidential data and permits unauthorized changes to identity/access state. No public exploit identified at time of analysis; the only reference is Microsoft's MSRC advisory, which is consistent with a vendor-discovered, service-side-remediated cloud flaw.
RemediationAI
Because Entra ID is a Microsoft-operated cloud service, the fix is applied by Microsoft server-side rather than by customer patching - Patch available per vendor advisory (MSRC): review https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62916 for the specific mitigation and any required tenant-side actions. Administrators should confirm the advisory's remediation status, review Entra sign-in and audit logs for anomalous token issuance or privilege changes, enforce phishing-resistant multi-factor authentication and conditional-access policies, tighten privileged-role assignments (PIM/just-in-time), and revoke/rotate sessions and tokens if compromise is suspected; the trade-off of aggressive session revocation is temporary user disruption. No exact fix version is applicable to a versionless cloud service, so do not assume a downloadable patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Microsoft Entra ID is Microsoft's cloud-based identity provider that handles authentication (OAuth 2.0/OpenID Connect, SAML, token issuance) and conditional-access authorization for Azure, Microsoft 365, and integrated SaaS applications. The root cause is CWE-288, authentication bypass using an alternate path or channel: an authorization or authentication check enforced on the primary code path can be circumvented by reaching the protected functionality through a secondary route that does not perform the same validation. The CPE cpe:2.3:a:microsoft:entra_id:-:*:*:*:*:*:*:* confirms the affected component is the Entra ID service itself (a versionless cloud offering), so remediation is delivered on the Microsoft service side rather than by customer patching.
Know when Entra Id gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Auth-bypass reachable remotely with no privileges or interaction and total identity compromise justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H, matching the vendor vector.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Entra ID, the cloud identity service that manages authentication and authorization for Microsoft 365, Azure, and federated third-party applications across most enterprises, contains a critical privilege escalation vulnerability allowing unauthenticated remote attackers to bypass authentication and gain elevated privileges. No patch is currently available. Successful exploitation could enable account takeovers, lateral movement into Azure environments, and compromise of sensitive data and systems dependent on Entra ID for access control.
Until a vendor patch is released: Enforce mandatory phishing-resistant MFA for all accounts, with priority for administrative and privileged users; configure Conditional Access policies to restrict sign-in by location, trusted device status, and real-time risk assessment; enable comprehensive audit logging and enable alerts for privilege escalation, role modifications, and tokens granted to sensitive applications; reduce and audit all standing privileged assignments; implement network segmentation to limit lateral movement from any compromised account; establish continuous monitoring dashboards for Entra ID sign-in and directory activity anomalies.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in Microsoft Entra ID (CWE-306, missing authentication for a critical function) lets remote, unaut
Azure Entra ID Elevation of Privilege Vulnerability. Rated critical severity (CVSS 10.0), this vulnerability is remotely
Spoofing vulnerability in Microsoft Entra ID (formerly Azure Active Directory) enables an authenticated low-privilege ne
Elevation of privilege in Microsoft Entra ID could enable an unauthenticated remote attacker to gain higher privileges,
Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permission
Missing authorization in Microsoft Entra ID allows an attacker who already holds a valid low-privilege identity - a comp
Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated at
Exploit-DB